{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "d7905674",
   "metadata": {},
   "source": [
    "## Lesson 2: A closer look into OFRAK unpacking and the resource tree"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "5c98bff3",
   "metadata": {},
   "source": [
    "**Objectives**: unpack a resource; learn about OFRAK components; learn about auto-analysis, tags, and the resource tree; filter the resource tree"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "8267f57c",
   "metadata": {},
   "source": [
    "Let's dive a bit deeper into the binary."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "4f0b5a52",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Using OFRAK Community License.\n"
     ]
    }
   ],
   "source": [
    "from ofrak import OFRAK\n",
    "from ofrak_tutorial.helper_functions import create_hello_world_binary\n",
    "\n",
    "create_hello_world_binary()\n",
    "\n",
    "ofrak = OFRAK()\n",
    "basic_context = await ofrak.create_ofrak_context()\n",
    "root_resource = await basic_context.create_root_resource_from_file(\"hello_world\")"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "57e0b95b",
   "metadata": {},
   "source": [
    "To get more information about this binary, we want to identify what type of file it is, analyze it for attributes, and unpack it into child resources. We can do this all at once with one function call in OFRAK."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "1c3e9a0c",
   "metadata": {},
   "outputs": [],
   "source": [
    "unpack_result = await root_resource.unpack_recursively()"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "1fce1bd3",
   "metadata": {},
   "source": [
    "The result of calling `unpack_recursively()` is a `ComponentRunResult` object. The details of this object are not important, but it contains two significant pieces of information:"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c229da79",
   "metadata": {},
   "source": [
    "- A number of resources were created and modified:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "3e3fcd40",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "147 resources created\n",
      "148 resources modified\n"
     ]
    }
   ],
   "source": [
    "print(f\"{len(unpack_result.resources_created)} resources created\")\n",
    "print(f\"{len(unpack_result.resources_modified)} resources modified\")"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "1557d982",
   "metadata": {},
   "source": [
    "- Several **components** were run on our resource, including `MagicIdentifier` and `ElfUnpacker`:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "16b6642d",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "components run: [b'ElfDynamicSectionUnpacker', b'ElfPointerArraySectionUnpacker', b'ElfRelaUnpacker', b'ElfSymbolUnpacker', b'ElfUnpacker', b'MagicIdentifier']\n"
     ]
    }
   ],
   "source": [
    "print(f\"components run: {sorted(unpack_result.components_run)}\")"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "507b1856",
   "metadata": {},
   "source": [
    "Components in OFRAK are the objects that perform actions on resources. Components can be: **unpackers**, **packers**, **modifiers**, **identifiers**, or **analyzers**.\n",
    "\n",
    "Here's a typical OFRAK workflow in terms of these components:\n",
    "\n",
    "- create an OFRAK resource from something, typically a file on disk\n",
    "  + **unpack** the resource (this step uses **identifiers**)\n",
    "    - **modify** the resource (possibly using **analyzers**)\n",
    "  + re-**pack** the resource\n",
    "- export the modified and repacked resource, typically to a file on disk\n",
    "\n",
    "(Note: [Lesson 1](1_simple_string_modification.ipynb) presented a simpler workflow: as we only needed to access and modify the binary data of the file, unpacking and repacking weren't necessary, so we only created the resource from a file, modified its binary data, and flushed the result to disk.)\n",
    "\n",
    "Back to what happened when unpacking our hello world binary. Here, the `MagicIdentifier` used `libmagic` on the binary to try and determine what type of file it is – in this case, it's an ELF executable. Based on this, OFRAK knows it needs to run the `ElfUnpacker`, which unpacked the binary into sections based on the known ELF file structure.\n",
    "\n",
    "Components can be manually selected and run on resources, or they can be run automatically, as we did here.\n",
    "\n",
    "Since we only had one resource before, but several were modified, it seems like the ELF unpacker has unpacked this file into some children! What does the resource tree look like now?"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "824d28d3",
   "metadata": {
    "tags": [
     "nbval-ignore-output"
    ]
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "┌3d0dba226977427db9da67ef90b8a6d6: [caption=(File: hello_world, Elf), attributes=(AttributesType[FilesystemEntry], Magic), global_offset=(0x0-0x4020), parent_offset=(0x0-0x0), data_hash=f5cd0893]\n",
      "├────983096a34da149daa8c65d378e109ae3: [caption=(ElfBasicHeader), attributes=(Data, AttributesType[ElfBasicHeader]), global_offset=(0x0-0x10), parent_offset=(0x0-0x10), data_hex=7f454c46020101000000000000000000]\n",
      "├────bff4ac13993b44b9ab74c93b7a6735ce: [caption=(ElfHeader), attributes=(Data, AttributesType[ElfHeader]), global_offset=(0x10-0x40), parent_offset=(0x10-0x40), data_hex=02003e000100000040104000000000004000000000000000e03800000000000000000000400038000b0040001d001c00]\n",
      "├────eec4b8662f584c758dc95684f0c5b542: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x38e0-0x3920), parent_offset=(0x38e0-0x3920), data_hex=00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000]\n",
      "├────2f742a92b98644129418aeac07fee851: [caption=(ElfSection), attributes=(AttributesType[ElfSectionStructure])]\n",
      "├────fbc45cbf43034f7bab865b92e30f48e4: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3920-0x3960), parent_offset=(0x3920-0x3960), data_hex=1b000000010000000200000000000000a802400000000000a8020000000000001c00000000000000000000000000000001000000000000000000000000000000]\n",
      "├────b9acbca9ba5844cb97b536a8451275bc: [caption=(ElfSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x2a8-0x2c4), parent_offset=(0x2a8-0x2c4), data_hex=2f6c696236342f6c642d6c696e75782d7838362d36342e736f2e3200]\n",
      "├────ba61ef91e8124d8eb1b79b081bc57284: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3960-0x39a0), parent_offset=(0x3960-0x39a0), data_hex=23000000070000000200000000000000c402400000000000c4020000000000002400000000000000000000000000000004000000000000000000000000000000]\n",
      "├────507bb08240904dc785e7c328c54cbbdc: [caption=(ElfSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x2c4-0x2e8), parent_offset=(0x2c4-0x2e8), data_hex=040000001400000003000000474e550017fb4e8bc7504a89fa3603690cb745adfd747237]\n",
      "├────4b27823bf6994068a1f68ee6757551fe: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x39a0-0x39e0), parent_offset=(0x39a0-0x39e0), data_hex=36000000070000000200000000000000e802400000000000e8020000000000002000000000000000000000000000000004000000000000000000000000000000]\n",
      "├────50123010c4cc4ffdb632f20b0f6e1e3a: [caption=(ElfSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x2e8-0x308), parent_offset=(0x2e8-0x308), data_hex=040000001000000001000000474e550000000000030000000200000000000000]\n",
      "├────0a07da2ed3b144daa19c012e82c8f374: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x39e0-0x3a20), parent_offset=(0x39e0-0x3a20), data_hex=44000000f6ffff6f0200000000000000080340000000000008030000000000001c00000000000000050000000000000008000000000000000000000000000000]\n",
      "├────51566b08303b4b6dad9aba60daec376f: [caption=(ElfSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x308-0x324), parent_offset=(0x308-0x324), data_hex=01000000010000000100000000000000000000000000000000000000]\n",
      "├────45212060af7c475f969406419c86ce35: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3a20-0x3a60), parent_offset=(0x3a20-0x3a60), data_hex=4e0000000b0000000200000000000000280340000000000028030000000000006000000000000000060000000100000008000000000000001800000000000000]\n",
      "├───┬4e749e4a7e1143d8b0f646bf57ba622d: [caption=(ElfDynSymbolSection: .dynsym), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[NamedProgramSection], AttributesType[MemoryRegion], AttributesType[Addressable]), global_offset=(0x328-0x388), parent_offset=(0x328-0x388), data_hex=0000000000000000000000000000000000000000000000000100000012000000000000000000000000000000000000000600000012000000000000000000000000000000000000002e0000002000000000000000000000000000000000000000]\n",
      "│   ├────d5b4db243e524a26acfda71521b14395: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x328-0x340), parent_offset=(0x0-0x18), data_hex=000000000000000000000000000000000000000000000000]\n",
      "│   ├────9d9a0decf49244ea9a5be5d2153ed25d: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x340-0x358), parent_offset=(0x18-0x30), data_hex=010000001200000000000000000000000000000000000000]\n",
      "│   ├────4a5b02290d6a4ae38ac43b4906bcccd4: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x358-0x370), parent_offset=(0x30-0x48), data_hex=060000001200000000000000000000000000000000000000]\n",
      "│   └────beadb4f638fc496196e59923e5d20159: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x370-0x388), parent_offset=(0x48-0x60), data_hex=2e0000002000000000000000000000000000000000000000]\n",
      "├────9924d03432e74d99a097b0b546e36bfe: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3a60-0x3aa0), parent_offset=(0x3a60-0x3aa0), data_hex=56000000030000000200000000000000880340000000000088030000000000003d00000000000000000000000000000001000000000000000000000000000000]\n",
      "├────bf2d7566366b4a55ab5f87e56bd0b834: [caption=(ElfSection, ElfStringSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x388-0x3c5), parent_offset=(0x388-0x3c5), data_hex=0070757473005f5f6c6962635f73746172745f6d61696e006c6962632e736f2e3600474c4942435f322e322e35005f5f676d6f6e5f73746172745f5f00]\n",
      "├────8654761e2bc04cf78b8a9090f4ae9976: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3aa0-0x3ae0), parent_offset=(0x3aa0-0x3ae0), data_hex=5e000000ffffff6f0200000000000000c603400000000000c6030000000000000800000000000000050000000000000002000000000000000200000000000000]\n",
      "├────11a71aaa02cc42a095cbb839cd474ea1: [caption=(ElfSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x3c6-0x3ce), parent_offset=(0x3c6-0x3ce), data_hex=0000020002000000]\n",
      "├────0c6c3494f6f6478ead7751753b4c6de9: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3ae0-0x3b20), parent_offset=(0x3ae0-0x3b20), data_hex=6b000000feffff6f0200000000000000d003400000000000d0030000000000002000000000000000060000000100000008000000000000000000000000000000]\n",
      "├────d037b4a7352b4bb99a4109307cbc6509: [caption=(ElfSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x3d0-0x3f0), parent_offset=(0x3d0-0x3f0), data_hex=01000100180000001000000000000000751a6909000002002200000000000000]\n",
      "├────e11e655e61a84675a618d80d1050934f: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3b20-0x3b60), parent_offset=(0x3b20-0x3b60), data_hex=7a000000040000000200000000000000f003400000000000f0030000000000003000000000000000050000000000000008000000000000001800000000000000]\n",
      "├───┬3af89663e1e3442699f3f8ec16a396b9: [caption=(ElfRelaSection: .rela.dyn), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[NamedProgramSection], AttributesType[MemoryRegion], AttributesType[Addressable]), global_offset=(0x3f0-0x420), parent_offset=(0x3f0-0x420), data_hex=f03f40000000000006000000020000000000000000000000f83f40000000000006000000030000000000000000000000]\n",
      "│   ├────c47496030ee441efa3eb03273eb220d6: [caption=(ElfRelaEntry), attributes=(Data), global_offset=(0x3f0-0x408), parent_offset=(0x0-0x18), data_hex=f03f40000000000006000000020000000000000000000000]\n",
      "│   └────4382dd6197804ec885e90c53b863fb28: [caption=(ElfRelaEntry), attributes=(Data), global_offset=(0x408-0x420), parent_offset=(0x18-0x30), data_hex=f83f40000000000006000000030000000000000000000000]\n",
      "├────931a4615cec24acb8bdbc1eceda02155: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3b60-0x3ba0), parent_offset=(0x3b60-0x3ba0), data_hex=84000000040000004200000000000000200440000000000020040000000000001800000000000000050000001600000008000000000000001800000000000000]\n",
      "├───┬70c34d4853c54f87b6dda12362a6096e: [caption=(ElfRelaSection: .rela.plt), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[NamedProgramSection], AttributesType[MemoryRegion], AttributesType[Addressable]), global_offset=(0x420-0x438), parent_offset=(0x420-0x438), data_hex=184040000000000007000000010000000000000000000000]\n",
      "│   └────203d00ee4bec483fbea7e371c760c255: [caption=(ElfRelaEntry), attributes=(Data), global_offset=(0x420-0x438), parent_offset=(0x0-0x18), data_hex=184040000000000007000000010000000000000000000000]\n",
      "├────6487d0078e7741c18139125516de1c15: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3ba0-0x3be0), parent_offset=(0x3ba0-0x3be0), data_hex=8e000000010000000600000000000000001040000000000000100000000000001700000000000000000000000000000004000000000000000000000000000000]\n",
      "├────864b2bbf22524fe7b686ae41e234518d: [caption=(CodeRegion, ElfSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x1000-0x1017), parent_offset=(0x1000-0x1017), data_hex=4883ec08488b05ed2f00004885c07402ffd04883c408c3]\n",
      "├────3f241bee1ca344b4a9da529df255a59e: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3be0-0x3c20), parent_offset=(0x3be0-0x3c20), data_hex=89000000010000000600000000000000201040000000000020100000000000002000000000000000000000000000000010000000000000001000000000000000]\n",
      "├────06806edc25954d3fa764e019556cd2de: [caption=(CodeRegion, ElfSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x1020-0x1040), parent_offset=(0x1020-0x1040), data_hex=ff35e22f0000ff25e42f00000f1f4000ff25e22f00006800000000e9e0ffffff]\n",
      "├────d6a0926169d34ab588da0e974b582c5a: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3c20-0x3c60), parent_offset=(0x3c20-0x3c60), data_hex=94000000010000000600000000000000401040000000000040100000000000006101000000000000000000000000000010000000000000000000000000000000]\n",
      "├────b18cd7cd86c14b2286bc6c2dde7cefd6: [caption=(CodeRegion, ElfSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x1040-0x11a1), parent_offset=(0x1040-0x11a1), data_hash=1eeedffe]\n",
      "├────9ed4d1c9c9f845b88daee4e74a235d63: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3c60-0x3ca0), parent_offset=(0x3c60-0x3ca0), data_hex=9a000000010000000600000000000000a411400000000000a4110000000000000900000000000000000000000000000004000000000000000000000000000000]\n",
      "├────30bb22f4cc284590a2ff5f47ff31a5ba: [caption=(CodeRegion, ElfSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x11a4-0x11ad), parent_offset=(0x11a4-0x11ad), data_hex=4883ec084883c408c3]\n",
      "├────ecf12c323abd459ca83ee70a1e3b8bb3: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3ca0-0x3ce0), parent_offset=(0x3ca0-0x3ce0), data_hex=a0000000010000000200000000000000002040000000000000200000000000001200000000000000000000000000000004000000000000000000000000000000]\n",
      "├────fcf40686f55042f8aa53a62e74fb375f: [caption=(ElfSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x2000-0x2012), parent_offset=(0x2000-0x2012), data_hex=0100020048656c6c6f2c20576f726c642100]\n",
      "├────0ba4b0513599410685b2e8038160fcdb: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3ce0-0x3d20), parent_offset=(0x3ce0-0x3d20), data_hex=a8000000010000000200000000000000142040000000000014200000000000003c00000000000000000000000000000004000000000000000000000000000000]\n",
      "├────611bc17f2c7a447491b3af59f6a34a09: [caption=(ElfSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x2014-0x2050), parent_offset=(0x2014-0x2050), data_hex=011b033b38000000060000000cf0ffff940000002cf0ffff540000005cf0ffff800000000ef1ffffbc0000002cf1ffffdc0000008cf1ffff24010000]\n",
      "├────c8003065a6544171bd97a4e0cb71d7d6: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3d20-0x3d60), parent_offset=(0x3d20-0x3d60), data_hex=b6000000010000000200000000000000502040000000000050200000000000000001000000000000000000000000000008000000000000000000000000000000]\n",
      "├────18d1c01565d841ad972d446e7c0d163e: [caption=(ElfSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x2050-0x2150), parent_offset=(0x2050-0x2150), data_hash=ef716b33]\n",
      "├────0665de0e04eb40969acf879a07a6bf52: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3d60-0x3da0), parent_offset=(0x3d60-0x3da0), data_hex=c00000000e0000000300000000000000103e400000000000102e0000000000000800000000000000000000000000000008000000000000000800000000000000]\n",
      "├───┬d3a7c73a1b6b439698e9b7cc467570c8: [caption=(ElfInitArraySection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x2e10-0x2e18), parent_offset=(0x2e10-0x2e18), data_hex=2011400000000000]\n",
      "│   └────8b9b2ea115a146afa77a2351308179db: [caption=(ElfVirtualAddress), attributes=(Data), global_offset=(0x2e10-0x2e18), parent_offset=(0x0-0x8), data_hex=2011400000000000]\n",
      "├────7e2fd8b69c2745498d836e55ccadd4e0: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3da0-0x3de0), parent_offset=(0x3da0-0x3de0), data_hex=cc0000000f0000000300000000000000183e400000000000182e0000000000000800000000000000000000000000000008000000000000000800000000000000]\n",
      "├───┬c48bb9f04e7249d9a362080fd72c1224: [caption=(ElfFiniArraySection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x2e18-0x2e20), parent_offset=(0x2e18-0x2e20), data_hex=f010400000000000]\n",
      "│   └────2ece07e43def49f4b62b18ec5ee7b7bc: [caption=(ElfVirtualAddress), attributes=(Data), global_offset=(0x2e18-0x2e20), parent_offset=(0x0-0x8), data_hex=f010400000000000]\n",
      "├────7ae0b307624c4edd8bf286abf4d1550e: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3de0-0x3e20), parent_offset=(0x3de0-0x3e20), data_hex=d8000000060000000300000000000000203e400000000000202e000000000000d001000000000000060000000000000008000000000000001000000000000000]\n",
      "├───┬2b29e162fef842729b355bbae7bc415c: [caption=(ElfDynamicSection: .dynamic), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[NamedProgramSection], AttributesType[MemoryRegion], AttributesType[Addressable]), global_offset=(0x2e20-0x2ff0), parent_offset=(0x2e20-0x2ff0), data_hash=4438de54]\n",
      "│   ├────574baf70c8964009b1b58e5b57e4a359: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2e20-0x2e30), parent_offset=(0x0-0x10), data_hex=01000000000000001800000000000000]\n",
      "│   ├────794cf28dd37a47118376e66bf52ca722: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2e30-0x2e40), parent_offset=(0x10-0x20), data_hex=0c000000000000000010400000000000]\n",
      "│   ├────0525f346344343d98672691c9f1b0f59: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2e40-0x2e50), parent_offset=(0x20-0x30), data_hex=0d00000000000000a411400000000000]\n",
      "│   ├────182cf0879be84505a97f5182c970a3a1: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2e50-0x2e60), parent_offset=(0x30-0x40), data_hex=1900000000000000103e400000000000]\n",
      "│   ├────d79e4cf997dc48c881fb7a507b0c5e01: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2e60-0x2e70), parent_offset=(0x40-0x50), data_hex=1b000000000000000800000000000000]\n",
      "│   ├────ed19b31ae7a3476cb2e471904a63c858: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2e70-0x2e80), parent_offset=(0x50-0x60), data_hex=1a00000000000000183e400000000000]\n",
      "│   ├────c40defd90fb341cea4a012e35068c99d: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2e80-0x2e90), parent_offset=(0x60-0x70), data_hex=1c000000000000000800000000000000]\n",
      "│   ├────93048e8bd4d34996a9ae66adeea9872d: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2e90-0x2ea0), parent_offset=(0x70-0x80), data_hex=f5feff6f000000000803400000000000]\n",
      "│   ├────8fc797372074448e86e0d8cde00a6804: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2ea0-0x2eb0), parent_offset=(0x80-0x90), data_hex=05000000000000008803400000000000]\n",
      "│   ├────70023116976444d9abfd26e7f83a8822: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2eb0-0x2ec0), parent_offset=(0x90-0xa0), data_hex=06000000000000002803400000000000]\n",
      "│   ├────18bded30c0754176a15d61d0ed98c15c: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2ec0-0x2ed0), parent_offset=(0xa0-0xb0), data_hex=0a000000000000003d00000000000000]\n",
      "│   ├────9f2972e46cd348a9b21cf9ff66c62d84: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2ed0-0x2ee0), parent_offset=(0xb0-0xc0), data_hex=0b000000000000001800000000000000]\n",
      "│   ├────bf4a503e5c6246e3a4e911f8298e7b52: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2ee0-0x2ef0), parent_offset=(0xc0-0xd0), data_hex=15000000000000000000000000000000]\n",
      "│   ├────62c370d791014e5abdba9a522df19a0c: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2ef0-0x2f00), parent_offset=(0xd0-0xe0), data_hex=03000000000000000040400000000000]\n",
      "│   ├────2c9c3e1048564edba89a9b1d4f26e9c0: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2f00-0x2f10), parent_offset=(0xe0-0xf0), data_hex=02000000000000001800000000000000]\n",
      "│   ├────b3b1a4a71c6a41f2a5ecc4950203c389: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2f10-0x2f20), parent_offset=(0xf0-0x100), data_hex=14000000000000000700000000000000]\n",
      "│   ├────cda0b21c814346a28045f80fd2da68cb: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2f20-0x2f30), parent_offset=(0x100-0x110), data_hex=17000000000000002004400000000000]\n",
      "│   ├────3a7f65c7aecc40f9bc242a2cbd8a6a21: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2f30-0x2f40), parent_offset=(0x110-0x120), data_hex=0700000000000000f003400000000000]\n",
      "│   ├────32fd22b8054c4e4193c410c3b030d7fd: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2f40-0x2f50), parent_offset=(0x120-0x130), data_hex=08000000000000003000000000000000]\n",
      "│   ├────f8c5954b6e5c4682beb2dbfcc7f5123e: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2f50-0x2f60), parent_offset=(0x130-0x140), data_hex=09000000000000001800000000000000]\n",
      "│   ├────c534273516544158ae6ee1f0f762ff00: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2f60-0x2f70), parent_offset=(0x140-0x150), data_hex=feffff6f00000000d003400000000000]\n",
      "│   ├────be270d96bf2040179d96d86392b3d756: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2f70-0x2f80), parent_offset=(0x150-0x160), data_hex=ffffff6f000000000100000000000000]\n",
      "│   ├────445e9e2477cd4e908ac05486212a4afb: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2f80-0x2f90), parent_offset=(0x160-0x170), data_hex=f0ffff6f00000000c603400000000000]\n",
      "│   ├────cd9cbec512ad42168c7a002332b3ab6e: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2f90-0x2fa0), parent_offset=(0x170-0x180), data_hex=00000000000000000000000000000000]\n",
      "│   ├────91c8e9212e2a44d38d18ab19720c0518: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2fa0-0x2fb0), parent_offset=(0x180-0x190), data_hex=00000000000000000000000000000000]\n",
      "│   ├────c85a08bf5f264ff1a125966666238b7f: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2fb0-0x2fc0), parent_offset=(0x190-0x1a0), data_hex=00000000000000000000000000000000]\n",
      "│   ├────2acc5cc2727041078c73b446d6bb41e5: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2fc0-0x2fd0), parent_offset=(0x1a0-0x1b0), data_hex=00000000000000000000000000000000]\n",
      "│   ├────2f6bdd1527a94066b2f7acc6850e3939: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2fd0-0x2fe0), parent_offset=(0x1b0-0x1c0), data_hex=00000000000000000000000000000000]\n",
      "│   └────05d03390d2864d01ace74d257f59684e: [caption=(ElfDynamicEntry), attributes=(Data), global_offset=(0x2fe0-0x2ff0), parent_offset=(0x1c0-0x1d0), data_hex=00000000000000000000000000000000]\n",
      "├────cf7e0b0bd3fe4c06aaa91bb14b438310: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3e20-0x3e60), parent_offset=(0x3e20-0x3e60), data_hex=e1000000010000000300000000000000f03f400000000000f02f0000000000001000000000000000000000000000000008000000000000000800000000000000]\n",
      "├────8bd20e3a826a478482be09aca2d9b0af: [caption=(ElfSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x2ff0-0x3000), parent_offset=(0x2ff0-0x3000), data_hex=00000000000000000000000000000000]\n",
      "├────8d4b6045b8b24f7f85d286722eba05e2: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3e60-0x3ea0), parent_offset=(0x3e60-0x3ea0), data_hex=e6000000010000000300000000000000004040000000000000300000000000002000000000000000000000000000000008000000000000000800000000000000]\n",
      "├────ac8b422f828448928fed357424d9f776: [caption=(ElfSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x3000-0x3020), parent_offset=(0x3000-0x3020), data_hex=203e400000000000000000000000000000000000000000003610400000000000]\n",
      "├────16e661e0cf054d54acd6d4c691f62c46: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3ea0-0x3ee0), parent_offset=(0x3ea0-0x3ee0), data_hex=ef000000010000000300000000000000204040000000000020300000000000001000000000000000000000000000000008000000000000000000000000000000]\n",
      "├────55955c5034a94af880451e0df3f0add0: [caption=(ElfSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x3020-0x3030), parent_offset=(0x3020-0x3030), data_hex=00000000000000000000000000000000]\n",
      "├────2ed9be0bd7c54b429dd07c4dae6cb273: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3ee0-0x3f20), parent_offset=(0x3ee0-0x3f20), data_hex=f5000000080000000300000000000000304040000000000030300000000000000800000000000000000000000000000001000000000000000000000000000000]\n",
      "├────2b4ebdca55224ee28801ae3870da814a: [caption=(ElfSection), attributes=(AttributesType[ElfSectionStructure])]\n",
      "├────7f631aeb90214f4ba31523b5ad48cc51: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3f20-0x3f60), parent_offset=(0x3f20-0x3f60), data_hex=fa000000010000003000000000000000000000000000000030300000000000002700000000000000000000000000000001000000000000000100000000000000]\n",
      "├────e9982a0dcd0b4c8385edcdf56bee047b: [caption=(ElfSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x3030-0x3057), parent_offset=(0x3030-0x3057), data_hex=4743433a202844656269616e2031302e322e312d36292031302e322e3120323032313031313000]\n",
      "├────cfb0970d896c4d728aaf32258fcfb111: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3f60-0x3fa0), parent_offset=(0x3f60-0x3fa0), data_hex=0100000002000000000000000000000000000000000000005830000000000000b8050000000000001b0000002b00000008000000000000001800000000000000]\n",
      "├───┬f91387d67ebd4c9cb4c115a94b35bd67: [caption=(ElfSymbolSection: .symtab), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[NamedProgramSection], AttributesType[MemoryRegion], AttributesType[Addressable]), global_offset=(0x3058-0x3610), parent_offset=(0x3058-0x3610), data_hash=f6bc0737]\n",
      "│   ├────bea52408e038445bbf3d1262d7b1dd97: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3058-0x3070), parent_offset=(0x0-0x18), data_hex=000000000000000000000000000000000000000000000000]\n",
      "│   ├────3c0df42eb1f34137badcfe83a854f223: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3070-0x3088), parent_offset=(0x18-0x30), data_hex=0000000003000100a8024000000000000000000000000000]\n",
      "│   ├────029d9a08b74d4bb6abcecef81d128980: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3088-0x30a0), parent_offset=(0x30-0x48), data_hex=0000000003000200c4024000000000000000000000000000]\n",
      "│   ├────ae4ee7882edb4334bac9ebed718eb3f7: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x30a0-0x30b8), parent_offset=(0x48-0x60), data_hex=0000000003000300e8024000000000000000000000000000]\n",
      "│   ├────d1aa0a91f0fa439fb2696d29cef76301: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x30b8-0x30d0), parent_offset=(0x60-0x78), data_hex=000000000300040008034000000000000000000000000000]\n",
      "│   ├────946af56d304b482ba52a2de9f449a91c: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x30d0-0x30e8), parent_offset=(0x78-0x90), data_hex=000000000300050028034000000000000000000000000000]\n",
      "│   ├────7d1798e9fda645dd8658de35cccbbb28: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x30e8-0x3100), parent_offset=(0x90-0xa8), data_hex=000000000300060088034000000000000000000000000000]\n",
      "│   ├────1b8dffc15be04c7daa8ace944288a7f4: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3100-0x3118), parent_offset=(0xa8-0xc0), data_hex=0000000003000700c6034000000000000000000000000000]\n",
      "│   ├────0896f3a0c9bd4fed94a40a98dbb9a11d: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3118-0x3130), parent_offset=(0xc0-0xd8), data_hex=0000000003000800d0034000000000000000000000000000]\n",
      "│   ├────c72e8e9201c1476db39e4e27cc7a0dbb: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3130-0x3148), parent_offset=(0xd8-0xf0), data_hex=0000000003000900f0034000000000000000000000000000]\n",
      "│   ├────840baa2351e04babbc850c723db52414: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3148-0x3160), parent_offset=(0xf0-0x108), data_hex=0000000003000a0020044000000000000000000000000000]\n",
      "│   ├────651fbab285f1429d9d57a86a7ff45c76: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3160-0x3178), parent_offset=(0x108-0x120), data_hex=0000000003000b0000104000000000000000000000000000]\n",
      "│   ├────08d9ed15624248fcb79104882d79c0a0: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3178-0x3190), parent_offset=(0x120-0x138), data_hex=0000000003000c0020104000000000000000000000000000]\n",
      "│   ├────bdfce445497042f6870590b13d91a871: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3190-0x31a8), parent_offset=(0x138-0x150), data_hex=0000000003000d0040104000000000000000000000000000]\n",
      "│   ├────94c448a33a6541029e6dd943a7348d65: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x31a8-0x31c0), parent_offset=(0x150-0x168), data_hex=0000000003000e00a4114000000000000000000000000000]\n",
      "│   ├────2af8af8f55ab4d56bdb2997865eefd65: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x31c0-0x31d8), parent_offset=(0x168-0x180), data_hex=0000000003000f0000204000000000000000000000000000]\n",
      "│   ├────34fc1aa1c2b645b78c5a9b8fd897391c: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x31d8-0x31f0), parent_offset=(0x180-0x198), data_hex=000000000300100014204000000000000000000000000000]\n",
      "│   ├────a941d25e9bc548fca6bbd3866c40bf32: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x31f0-0x3208), parent_offset=(0x198-0x1b0), data_hex=000000000300110050204000000000000000000000000000]\n",
      "│   ├────64ea572aa1f746ddbe862ee8d371d9b1: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3208-0x3220), parent_offset=(0x1b0-0x1c8), data_hex=0000000003001200103e4000000000000000000000000000]\n",
      "│   ├────807046db8b6d4f29901c1f05994f893c: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3220-0x3238), parent_offset=(0x1c8-0x1e0), data_hex=0000000003001300183e4000000000000000000000000000]\n",
      "│   ├────04b5ffcd668e494fab9afacdd929eb5f: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3238-0x3250), parent_offset=(0x1e0-0x1f8), data_hex=0000000003001400203e4000000000000000000000000000]\n",
      "│   ├────91831028b78d4b4fa463df8912561626: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3250-0x3268), parent_offset=(0x1f8-0x210), data_hex=0000000003001500f03f4000000000000000000000000000]\n",
      "│   ├────7543ccb848ae440d87838f3bc961d01a: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3268-0x3280), parent_offset=(0x210-0x228), data_hex=000000000300160000404000000000000000000000000000]\n",
      "│   ├────bcc5eed8fb984b72828154971c7ea243: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3280-0x3298), parent_offset=(0x228-0x240), data_hex=000000000300170020404000000000000000000000000000]\n",
      "│   ├────a2b0593a5fd441e9860a16e23b5835bd: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3298-0x32b0), parent_offset=(0x240-0x258), data_hex=000000000300180030404000000000000000000000000000]\n",
      "│   ├────98d49146d0304e99b8ef3046d94d35c8: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x32b0-0x32c8), parent_offset=(0x258-0x270), data_hex=000000000300190000000000000000000000000000000000]\n",
      "│   ├────1d67c5e3eaf845349d8e5866d6b8ffa1: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x32c8-0x32e0), parent_offset=(0x270-0x288), data_hex=010000000400f1ff00000000000000000000000000000000]\n",
      "│   ├────c294b11b8b2849d997e98fc63aa372d8: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x32e0-0x32f8), parent_offset=(0x288-0x2a0), data_hex=0c00000002000d0080104000000000000000000000000000]\n",
      "│   ├────c5cd68a7d6cd4bc78af67f9842d31ec6: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x32f8-0x3310), parent_offset=(0x2a0-0x2b8), data_hex=0e00000002000d00b0104000000000000000000000000000]\n",
      "│   ├────abe4a9891bd548b0a103041c94aa89f9: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3310-0x3328), parent_offset=(0x2b8-0x2d0), data_hex=2100000002000d00f0104000000000000000000000000000]\n",
      "│   ├────95f85e7c94654232b5f940d9d1d04d18: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3328-0x3340), parent_offset=(0x2d0-0x2e8), data_hex=370000000100180030404000000000000100000000000000]\n",
      "│   ├────aa28727d65dc49be969479967203caba: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3340-0x3358), parent_offset=(0x2e8-0x300), data_hex=4300000001001300183e4000000000000000000000000000]\n",
      "│   ├────21b6eeae52ff4b6aa4f2c4383d53c77a: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3358-0x3370), parent_offset=(0x300-0x318), data_hex=6a00000002000d0020114000000000000000000000000000]\n",
      "│   ├────926011c8d73847579365448aac9cf68b: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3370-0x3388), parent_offset=(0x318-0x330), data_hex=7600000001001200103e4000000000000000000000000000]\n",
      "│   ├────cb62379a2779439d9761ae642d465bc9: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3388-0x33a0), parent_offset=(0x330-0x348), data_hex=950000000400f1ff00000000000000000000000000000000]\n",
      "│   ├────3fdf500c6bbf48a79a336432d2ed86cc: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x33a0-0x33b8), parent_offset=(0x348-0x360), data_hex=010000000400f1ff00000000000000000000000000000000]\n",
      "│   ├────c9adeae59b5c45d4a0ccc2c31b920a05: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x33b8-0x33d0), parent_offset=(0x360-0x378), data_hex=a3000000010011004c214000000000000000000000000000]\n",
      "│   ├────7e3e6e00a1aa40609c6627686fd8ffc5: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x33d0-0x33e8), parent_offset=(0x378-0x390), data_hex=000000000400f1ff00000000000000000000000000000000]\n",
      "│   ├────2853ff4fa52645c5aebbcd89619eb903: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x33e8-0x3400), parent_offset=(0x390-0x3a8), data_hex=b100000000001200183e4000000000000000000000000000]\n",
      "│   ├────572ea487ef8548709244f682d1932c47: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3400-0x3418), parent_offset=(0x3a8-0x3c0), data_hex=c200000001001400203e4000000000000000000000000000]\n",
      "│   ├────ab6bc3a6b1f04d30bd70cbcddd0b0bf0: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3418-0x3430), parent_offset=(0x3c0-0x3d8), data_hex=cb00000000001200103e4000000000000000000000000000]\n",
      "│   ├────c81901f0af7a49e1a7859a0e041b3c76: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3430-0x3448), parent_offset=(0x3d8-0x3f0), data_hex=de0000000000100014204000000000000000000000000000]\n",
      "│   ├────68bc4e34defa4944aa3789d5846adfba: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3448-0x3460), parent_offset=(0x3f0-0x408), data_hex=f10000000100160000404000000000000000000000000000]\n",
      "│   ├────8fbc1be743a540d989cafad56f9f635e: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3460-0x3478), parent_offset=(0x408-0x420), data_hex=0701000012000d00a0114000000000000100000000000000]\n",
      "│   ├────2aa7d42527874b2a8b163f3436ed7315: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3478-0x3490), parent_offset=(0x420-0x438), data_hex=4f0100002000170020404000000000000000000000000000]\n",
      "│   ├────24b9504458f1464bab539f3a86b4be05: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3490-0x34a8), parent_offset=(0x438-0x450), data_hex=170100001200000000000000000000000000000000000000]\n",
      "│   ├────f2d144fb82e645f9a7a5dc04b7649de6: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x34a8-0x34c0), parent_offset=(0x450-0x468), data_hex=280100001000170030404000000000000000000000000000]\n",
      "│   ├────c90080d1376448c49d92d0f079f68863: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x34c0-0x34d8), parent_offset=(0x468-0x480), data_hex=1101000012020e00a4114000000000000000000000000000]\n",
      "│   ├────e9ab222ca4be48bda7ecda36e6e0d18e: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x34d8-0x34f0), parent_offset=(0x480-0x498), data_hex=2f0100001200000000000000000000000000000000000000]\n",
      "│   ├────50c77ceda355423698e829f406b49e60: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x34f0-0x3508), parent_offset=(0x498-0x4b0), data_hex=4d0100001000170020404000000000000000000000000000]\n",
      "│   ├────f3a8996f30db4ce58817d674b14e5ffe: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3508-0x3520), parent_offset=(0x4b0-0x4c8), data_hex=5a0100002000000000000000000000000000000000000000]\n",
      "│   ├────eacd79b6ff40496ea5b2f1526bcffd23: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3520-0x3538), parent_offset=(0x4c8-0x4e0), data_hex=690100001102170028404000000000000000000000000000]\n",
      "│   ├────bfd317bc91d443e78d66d829bc645f2c: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3538-0x3550), parent_offset=(0x4e0-0x4f8), data_hex=7601000011000f0000204000000000000400000000000000]\n",
      "│   ├────da006edbe2b0428fae3631fb89e8b585: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3550-0x3568), parent_offset=(0x4f8-0x510), data_hex=8501000012000d0040114000000000005d00000000000000]\n",
      "│   ├────daffdd5002c749f89bbd8154da4aa549: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3568-0x3580), parent_offset=(0x510-0x528), data_hex=bd0000001000180038404000000000000000000000000000]\n",
      "│   ├────9b5f6d46336c4df8a8cc7c83936637d1: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3580-0x3598), parent_offset=(0x528-0x540), data_hex=9501000012020d0070104000000000000100000000000000]\n",
      "│   ├────47857a9d9bdc4ca593d04bd6e70fca3a: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x3598-0x35b0), parent_offset=(0x540-0x558), data_hex=5301000012000d0040104000000000002b00000000000000]\n",
      "│   ├────84b1c16bb64444b6afbd06d318ad0668: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x35b0-0x35c8), parent_offset=(0x558-0x570), data_hex=ad0100001000180030404000000000000000000000000000]\n",
      "│   ├────4821acf5f6bc4ce08925b965f82be4ff: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x35c8-0x35e0), parent_offset=(0x570-0x588), data_hex=b901000012000d0022114000000000001700000000000000]\n",
      "│   ├────1e6bc715d8bb4303828f8e9d52d7097e: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x35e0-0x35f8), parent_offset=(0x588-0x5a0), data_hex=be0100001102170030404000000000000000000000000000]\n",
      "│   └────a00710a95c854e329365b6e1b71f95bc: [caption=(ElfSymbol), attributes=(Data, AttributesType[ElfSymbolStructure]), global_offset=(0x35f8-0x3610), parent_offset=(0x5a0-0x5b8), data_hex=8f01000012020b0000104000000000000000000000000000]\n",
      "├────3a9c1a3b56fe4fa8a9e0278830fad5cf: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3fa0-0x3fe0), parent_offset=(0x3fa0-0x3fe0), data_hex=0900000003000000000000000000000000000000000000001036000000000000ca01000000000000000000000000000001000000000000000000000000000000]\n",
      "├────d3592293824a4143b9b8ccb7c6e11075: [caption=(ElfSection, ElfStringSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x3610-0x37da), parent_offset=(0x3610-0x37da), data_hash=800e56e9]\n",
      "├────86b54781e13847f6a92ccee8265f892a: [caption=(ElfSectionHeader), attributes=(Data, AttributesType[ElfSectionStructure], AttributesType[ElfSectionHeader]), global_offset=(0x3fe0-0x4020), parent_offset=(0x3fe0-0x4020), data_hex=110000000300000000000000000000000000000000000000da370000000000000301000000000000000000000000000001000000000000000000000000000000]\n",
      "├────1eed3692afa5448490d7483b51747523: [caption=(ElfSection, ElfSectionNameStringSection), attributes=(Data, AttributesType[ElfSectionStructure]), global_offset=(0x37da-0x38dd), parent_offset=(0x37da-0x38dd), data_hash=6db41dea]\n",
      "├────c6b768505aa143bbb3c9bd1ddb327d7c: [caption=(ElfProgramHeader: PHDR, R), attributes=(Data, AttributesType[ElfSegmentStructure], AttributesType[ElfProgramHeader]), global_offset=(0x40-0x78), parent_offset=(0x40-0x78), data_hex=0600000004000000400000000000000040004000000000004000400000000000680200000000000068020000000000000800000000000000]\n",
      "├────35ecd448afa8412dae0da90acd2cc544: [caption=(ElfProgramHeader: INTERP, R), attributes=(Data, AttributesType[ElfSegmentStructure], AttributesType[ElfProgramHeader]), global_offset=(0x78-0xb0), parent_offset=(0x78-0xb0), data_hex=0300000004000000a802000000000000a802400000000000a8024000000000001c000000000000001c000000000000000100000000000000]\n",
      "├────edb40ae550874aa4aabca7ad084b4482: [caption=(ElfProgramHeader: LOAD, R), attributes=(Data, AttributesType[ElfSegmentStructure], AttributesType[ElfProgramHeader]), global_offset=(0xb0-0xe8), parent_offset=(0xb0-0xe8), data_hex=0100000004000000000000000000000000004000000000000000400000000000380400000000000038040000000000000010000000000000]\n",
      "├────2fc5220cf4c84caf80bf8d0b3c9aa955: [caption=(ElfProgramHeader: LOAD, RX), attributes=(Data, AttributesType[ElfSegmentStructure], AttributesType[ElfProgramHeader]), global_offset=(0xe8-0x120), parent_offset=(0xe8-0x120), data_hex=0100000005000000001000000000000000104000000000000010400000000000ad01000000000000ad010000000000000010000000000000]\n",
      "├────c5f79f29f586479d8b576459f3cd500b: [caption=(ElfProgramHeader: LOAD, R), attributes=(Data, AttributesType[ElfSegmentStructure], AttributesType[ElfProgramHeader]), global_offset=(0x120-0x158), parent_offset=(0x120-0x158), data_hex=0100000004000000002000000000000000204000000000000020400000000000500100000000000050010000000000000010000000000000]\n",
      "├────2f309fda2f97478f950dd1087eb48966: [caption=(ElfProgramHeader: LOAD, RW), attributes=(Data, AttributesType[ElfSegmentStructure], AttributesType[ElfProgramHeader]), global_offset=(0x158-0x190), parent_offset=(0x158-0x190), data_hex=0100000006000000102e000000000000103e400000000000103e400000000000200200000000000028020000000000000010000000000000]\n",
      "├────9b405e6cfaba45ba9064f6501c9982e6: [caption=(ElfProgramHeader: DYNAMIC, RW), attributes=(Data, AttributesType[ElfSegmentStructure], AttributesType[ElfProgramHeader]), global_offset=(0x190-0x1c8), parent_offset=(0x190-0x1c8), data_hex=0200000006000000202e000000000000203e400000000000203e400000000000d001000000000000d0010000000000000800000000000000]\n",
      "├────91212a31a4bf443c9553276c9cdcde8f: [caption=(ElfProgramHeader: NOTE, R), attributes=(Data, AttributesType[ElfSegmentStructure], AttributesType[ElfProgramHeader]), global_offset=(0x1c8-0x200), parent_offset=(0x1c8-0x200), data_hex=0400000004000000c402000000000000c402400000000000c402400000000000440000000000000044000000000000000400000000000000]\n",
      "├────30fae78983f54872a2e4545443fecbb4: [caption=(ElfProgramHeader: GNU_EH_FRAME, R), attributes=(Data, AttributesType[ElfSegmentStructure], AttributesType[ElfProgramHeader]), global_offset=(0x200-0x238), parent_offset=(0x200-0x238), data_hex=50e57464040000001420000000000000142040000000000014204000000000003c000000000000003c000000000000000400000000000000]\n",
      "├────f24f7d2b7d3742808c2aed5c3c406bc1: [caption=(ElfProgramHeader: GNU_STACK, RW), attributes=(Data, AttributesType[ElfSegmentStructure], AttributesType[ElfProgramHeader]), global_offset=(0x238-0x270), parent_offset=(0x238-0x270), data_hex=51e5746406000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000]\n",
      "└────79f29143b71d496a94689bd641d9023e: [caption=(ElfProgramHeader: GNU_RELRO, R), attributes=(Data, AttributesType[ElfSegmentStructure], AttributesType[ElfProgramHeader]), global_offset=(0x270-0x2a8), parent_offset=(0x270-0x2a8), data_hex=52e5746404000000102e000000000000103e400000000000103e400000000000f001000000000000f0010000000000000100000000000000]\n",
      "\n"
     ]
    }
   ],
   "source": [
    "info = await root_resource.summarize_tree()\n",
    "print(info)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "2a51c552",
   "metadata": {},
   "source": [
    "This tree has a lot more information than before. Which kinds of children were created? Let's have a look at their *tags*, which essentially describe the possible types that OFRAK knows for a resource."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "99859d11",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Addressable\n",
      "CodeRegion\n",
      "ElfBasicHeader\n",
      "ElfDynSymbolSection\n",
      "ElfDynamicEntry\n",
      "ElfDynamicSection\n",
      "ElfFiniArraySection\n",
      "ElfHeader\n",
      "ElfInitArraySection\n",
      "ElfPointerArraySection\n",
      "ElfProgramHeader\n",
      "ElfRelaEntry\n",
      "ElfRelaSection\n",
      "ElfSection\n",
      "ElfSectionHeader\n",
      "ElfSectionNameStringSection\n",
      "ElfSectionStructure\n",
      "ElfSegmentStructure\n",
      "ElfStringSection\n",
      "ElfSymbol\n",
      "ElfSymbolSection\n",
      "ElfSymbolStructure\n",
      "ElfVirtualAddress\n",
      "MemoryRegion\n",
      "NamedProgramSection\n",
      "ProgramSection\n"
     ]
    }
   ],
   "source": [
    "async def get_descendants_tags(resource):\n",
    "    \"\"\"Return an alphabetically sorted list of all the tags of the descendants of `resource`.\"\"\"\n",
    "    all_tags = set()\n",
    "    for child_resource in await resource.get_descendants():\n",
    "        all_tags |= set(child_resource.get_tags())\n",
    "    return sorted(all_tags, key=str)\n",
    "\n",
    "\n",
    "for tag in await get_descendants_tags(root_resource):\n",
    "    print(tag)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "12c6fa95",
   "metadata": {},
   "source": [
    "OFRAK has analyzed the binary down to basically its ELF sections, headers and symbols. No instructions? That's because we haven't told OFRAK which analysis backend to use. Available backends are Ghidra and BinaryNinja; we'll introduce them later, when we need them."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c477afd5",
   "metadata": {},
   "source": [
    "How would we get all the resources in the tree with a `CodeRegion` tag? We can use one of OFRAK's filtering capabilities, `ResourceFilter.with_tags`:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "id": "f1dd1f92",
   "metadata": {
    "tags": [
     "nbval-ignore-output"
    ]
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[Resource(resource_id=06806edc25954d3fa764e019556cd2de, tag=[CodeRegion,NamedProgramSection,ProgramSection,ElfSection,MemoryRegion,Addressable,ElfSectionStructure], data=06806edc25954d3fa764e019556cd2de),\n",
       " Resource(resource_id=b18cd7cd86c14b2286bc6c2dde7cefd6, tag=[CodeRegion,NamedProgramSection,ProgramSection,ElfSection,MemoryRegion,Addressable,ElfSectionStructure], data=b18cd7cd86c14b2286bc6c2dde7cefd6),\n",
       " Resource(resource_id=864b2bbf22524fe7b686ae41e234518d, tag=[CodeRegion,NamedProgramSection,ProgramSection,ElfSection,MemoryRegion,Addressable,ElfSectionStructure], data=864b2bbf22524fe7b686ae41e234518d),\n",
       " Resource(resource_id=30bb22f4cc284590a2ff5f47ff31a5ba, tag=[CodeRegion,NamedProgramSection,ProgramSection,ElfSection,MemoryRegion,Addressable,ElfSectionStructure], data=30bb22f4cc284590a2ff5f47ff31a5ba)]"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "from ofrak.core import CodeRegion\n",
    "from ofrak import ResourceFilter\n",
    "\n",
    "list(await root_resource.get_descendants(r_filter=ResourceFilter.with_tags(CodeRegion)))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "086319a6",
   "metadata": {},
   "source": [
    "[Next page](3_binary_format_modification.ipynb)"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.18"
  },
  "pycharm": {
   "stem_cell": {
    "cell_type": "raw",
    "metadata": {
     "collapsed": false
    },
    "source": []
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}
